[kmbfjr]

They most certainly are. Large ISPs use Nokia Deepfield or Kentik for network monitoring, observability and user metrics. Both work due to volumes of metadata from net flows and DNS.

My gut tells me the broken intercept is a Nokia product.

[schwag09]

This is correct, it's even open source: https://github.com/deepfield/dnsflow.